github.com/nats-io/nats-server/v2

CRITICAL 9.6

Go

CVE-2025-30215

NATS Server may fail to authorize certain Jetstream admin APIs

Apr 15, 2025

MEDIUM 5.3

Go

CVE-2026-33219

NATS is vulnerable to pre-auth DoS through WebSockets client service

Mar 24, 2026

MEDIUM 5.9

Go

CVE-2026-27571

nats-server websockets are vulnerable to pre-auth memory DoS

Feb 24, 2026

UNKNOWN

Go

CVE-2026-29785

NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server

Mar 26, 2026

HIGH 7.5

Go

CVE-2020-28466

Denial of service in github.com/nats-io/nats-server/server

Feb 15, 2022

UNKNOWN

Go

CVE-2026-33249

NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server

Mar 26, 2026

MEDIUM 4.3

Go

CVE-2026-33249

NATS: Message tracing can be redirected to arbitrary subject

Mar 24, 2026

HIGH 7.5

Go

CVE-2026-33218

NATS has pre-auth server panic via leafnode handling

Mar 24, 2026

HIGH 8.6

Go

CVE-2026-33216

NATS has MQTT plaintext password disclosure

Mar 24, 2026

HIGH 7.5

Go

CVE-2026-27889

NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead

Mar 25, 2026

MEDIUM 6.4

Go

CVE-2026-33223

NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

Mar 24, 2026

MEDIUM 6.4

Go

CVE-2026-33246

NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

Mar 24, 2026

HIGH 7.1

Go

CVE-2026-33217

NATS allows MQTT clients to bypass ACL checks

Mar 24, 2026

MEDIUM 4.2

Go

CVE-2026-33248

NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching

Mar 24, 2026

HIGH 7.5

Go

CVE-2026-29785

NATS Server panic via malicious compression on leafnode port

Mar 24, 2026

MEDIUM 4.9

Go

CVE-2026-33222

NATS JetStream has an authorization bypass through its Management API

Mar 24, 2026

MEDIUM 6.5

Go

CVE-2026-33215

NATS is vulnerable to MQTT hijacking via Client ID

Mar 24, 2026

HIGH 7.4

Go

CVE-2026-33247

NATS credentials are exposed in monitoring port via command-line argv

Mar 24, 2026

UNKNOWN

Go

CVE-2026-33218

NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server

Mar 26, 2026

UNKNOWN

Go

CVE-2026-33247

NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server

Mar 26, 2026

UNKNOWN

Go

CVE-2026-33223

NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server

Mar 26, 2026

UNKNOWN

Go

CVE-2026-33216

NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server

Mar 26, 2026

UNKNOWN

Go

CVE-2026-33222

NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server

Mar 26, 2026

UNKNOWN

Go

CVE-2026-33219

NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server

Mar 26, 2026

UNKNOWN

Go

CVE-2026-33246

NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server

Mar 26, 2026

UNKNOWN

Go

CVE-2026-33248

NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server

Mar 26, 2026

UNKNOWN

Go

CVE-2026-33217

NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server

Mar 26, 2026

UNKNOWN

Go

CVE-2026-33215

NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server

Mar 26, 2026

UNKNOWN

Go

CVE-2026-27889

NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server

Mar 26, 2026

MEDIUM 6.5

Go

CVE-2022-26652

Arbitrary file write in nats-server

Mar 10, 2022

UNKNOWN

Go

CVE-2020-28466

Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server

Aug 21, 2024

UNKNOWN

Go

CVE-2022-29946

NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects in github.com/nats-io/nats-server

Jul 12, 2024

UNKNOWN

Go

CVE-2022-28357

NATS nats-server allows directory traversal via unintended path to a management action in github.com/nats-io/nats-server

Aug 21, 2024

UNKNOWN

Go

CVE-2022-24450

Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-server

Aug 21, 2024

UNKNOWN

Go

CVE-2022-26652

Arbitrary file write in nats-server in github.com/nats-io/nats-server

Aug 21, 2024

UNKNOWN

Go

CVE-2026-27571

nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server

Feb 25, 2026

UNKNOWN

Go

CVE-2021-32026

NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server

Jun 5, 2024

UNKNOWN

Go

CVE-2023-47090

Authorization bypass in github.com/nats-io/nats-server/v2

Oct 24, 2023

HIGH 7.5

Go

CVE-2020-26521

Nil dereference in NATS JWT causing DoS of nats-server

May 21, 2021

HIGH 7.5

Go

GO-2022-0398

Import loops in account imports, nats-server DoS

May 21, 2021

UNKNOWN

Go

CVE-2020-26892

Incorrect handling of credential expiry by /nats-io/nats-server

May 21, 2021

HIGH 7.5

Go

CVE-2019-13126

Integer Overflow or Wraparound in NATS Server

May 18, 2021

UNKNOWN

Go

CVE-2019-13126

Integer Overflow or Wraparound in NATS Server in github.com/nats-io/nats-server

Aug 21, 2024

UNKNOWN

Go

GHSA-gwj5-3vfq-q992

Import loops in account imports, nats-server DoS in github.com/nats-io/nats-server

Aug 21, 2024

UNKNOWN

Go

CVE-2025-30215

Missing ACLs on JavaScript APIs allowing privilege escalation github.com/nats-io/nats-server

Apr 22, 2025

UNKNOWN

Go

CVE-2021-32026

NATS server TLS missing ciphersuite settings when CLI flags used

May 14, 2024

HIGH 7.5

Go

CVE-2021-3127

github.com/nats-io/nats-server Import token permissions checking not enforced

May 21, 2021

HIGH 7.5

Go

CVE-2021-3127

Duplicate Advisory: Incorrect Access Control in github.com/nats-io/jwt and github.com/nats-io/nats-server/v2

Feb 15, 2022

UNKNOWN

Go

CVE-2023-47090

NATS.io: Adding accounts for just the system account adds auth bypass

Oct 19, 2023

HIGH 7.5

Go

CVE-2023-46129

xkeys seal encryption used fixed key for all encryption

Oct 31, 2023

MEDIUM 6.5

Go

CVE-2022-29946

NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects

Jul 11, 2024

HIGH 8.8

Go

CVE-2022-24450

Incorrect Authorization in NATS nats-server

Feb 8, 2022

UNKNOWN

Go

GHSA-4frv-5fj6-4p25

Duplicate Advisory: NATS.io: Adding accounts for just the system account adds auth bypass

Oct 30, 2023